Incident

Claude Code put users' email addresses in the User-Agent header

Published 2026-11-08

In November 2026, users noticed that Claude Code sometimes sent their account email address to websites it contacted, by putting it into the User-Agent header of curl and similar commands. Here is what was reported, with links to the original sources.

What happened

Users reported the behaviour in a Hacker News discussion and in a GitHub issue on the Claude Code repository.

The pattern makes sense once you know that some websites, such as the SEC’s data API, ask automated clients to include a contact email address in their request headers. When Claude Code hit such a requirement, it sometimes filled in the user’s own email to make the request succeed.

What Anthropic said

A member of Anthropic’s Claude Code team replied on Hacker News. According to that reply:

• The account email had been added to the model’s context, to stop Claude from writing made-up names in places such as @author tags.
• When Claude wrote its own curl and similar commands, it sometimes used that email as a contact address in the User-Agent.
• The next version would remove the email from the context.
• Version 2.1.317 and later include a module, on by default, that asks the user first when a network request or curl-style command contains their email. It does not cover every case.
• At the time, the stable release channel was still on version 2.1.311.

How complete is the fix?

The module’s published README, as quoted in GitHub issue #107144, says it only stops shell commands that contain both the account email and text naming a User-Agent, such as User-Agent, curl -A or wget -U. By that description, commands that put the email somewhere else, such as a URL parameter or a request body, are not caught. Users testing the shipped versions in that issue reported conflicting results: some saw it block more than the README describes, others saw no block at all. So don’t count on it, and test your own setup.

Check whether it happened to you

Claude Code stores session transcripts on your computer in ~/.claude/projects/. You can search them for your email address and see whether it ever appeared next to a User-Agent. Our step-by-step guide: How to check whether Claude Code sent your email.

Test your setup now

The behaviour depends on the version, the model and even on luck, so the best way to know is to try it. Our test takes about a minute: you paste one prompt into Claude Code and watch what it sends to a website that asks for a contact email.

Test Claude Code now →